Classification

Category: Malware

Type: Worm

Aliases: Amus.A, I-Worm.Amus.a

Summary


Amus was found on 5th of August 2004. It's a simple massmailer written in Visual Basic.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Amus is packed with Yoda. It's packed size is 51782.

Once executed it creates a a mutex named "Masum". In order to avoid being run more than once. And copies itself to

C:\masum.exe

It drops copies of itself in the Windows folder with names from:

Messenger.exe
My_Pictures.exe
Meydanbasi.exe
Pide.exe
Pire.exe
Cekirge.exe
Ankara.exe
Adapazari.exe
Anti_Virus.exe
KdzEregli.exe

A registry key will be set to point to one of the dropped files:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
"Microzoft_Ofiz" = "C:\%WinDir%\KdzEregli.exe"

Where %WinDir% is the main Windows folder.

Spreading in emails

It send emails with subject:

Listen and Smile

And body:

Hey. I beg your pardon. You must listen.

The attached file will be named:

masum.exe
Payload

When the virus is run, it uses the Windows Speech Engine to speak the following message:

How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa.
 You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.

To listen to what the message sounds like, listen to this audio file:

https://www.f-secure.com/weblog/archives/amus.wav

If the day of the month is 10th or 23rd, the worm will attempt to delete all INI files from the Windows folder.

If the day of the month is 2nd, 15th or 17th, the worm will attempt to delete all DLL files from the Windows folder.